MikroTik / RouterOS · Tutorial · September 2026

Centralised Wi-Fi
with CAPsMAN

Ten access points down a hotel corridor, one config. CAPsMAN turns a pile of MikroTik APs into a single managed system — change the guest password once and every radio updates, add an AP and it inherits everything, and guests roam room to room without dropping. This is the RouterOS 7 (WifiWave2) way, and the natural sequel to the hotel lab.

RouterOS 7 CAPsMAN WifiWave2 Wireless Roaming Hospitality cAP

The hotel lab configured two APs by hand, each with its own SSIDs. That's fine for two. For ten — a corridor of rooms, a lobby, a pool bar — hand-configuring each is how you end up with one AP on the wrong VLAN, another still broadcasting last season's password, and guests whose connection drops every time they walk past the lifts. CAPsMAN (Controlled Access Point system MANager) fixes that: one router becomes the manager, the APs become CAPs (Controlled APs) that download their entire config from it. Change something once; every AP follows.

RouterOS 7 rebuilt wireless around the WifiWave2 driver, and CAPsMAN with it — the config lives under /interface/wifi, not the old /caps-man. This post uses the modern stack: a manager, a common configuration all radios share, VLAN-tagged SSIDs that drop guests straight into the isolated guest network, non-overlapping channels, and the roaming that makes "walk anywhere" work. It's the capstone that makes the hotel lab scale.

Prerequisites

The Hotel Network lab — this scales its two hand-built APs to a managed fleet
VLAN Segmentation — CAPsMAN drops each SSID onto a VLAN over the trunk
RouterOS 7.13+ on the manager and APs; MikroTik APs with the wifi-qcom/wifi-qcom-ac driver (cAP ax, hAP ax, etc.)

Enable the Manager

Any RouterOS 7 device can be the manager — usually the gateway. One line turns it on; the CAPs will find it over the local network.

RouterOS 7 — on the gateway (the manager)

[admin@GW] > /interface/wifi/capsman set enabled=yes \
    interfaces=vlan99-mgmt package-path="" upgrade-policy=suggest-same-version

# Watch for CAPs trying to join (once they're pointed here — section 02):
[admin@GW] > /interface/wifi/capsman remote-cap print
 #  ADDRESS           IDENTITY     STATE    COMMON-NAME
 0  10.10.99.21       cap-lobby    Run      D4:01:...:21
 1  10.10.99.22       cap-wingA    Run      D4:01:...:22

💡 Manage on the Management VLAN

Point CAPsMAN's interfaces= at the management VLAN, not the guest one. The CAPWAP control channel between manager and CAPs (discovery, config push, keys) should ride the same isolated management segment as everything else you administer — never the network guests are on. This is the wireless half of the segmentation discipline from the hotel lab: control plane on VLAN 99, guest traffic tunnelled/tagged separately.

Turn an AP into a CAP

On each access point, one command hands its radios to the manager and stops it being a standalone device. After this, you never log into the AP again — you manage it from the manager.

RouterOS 7 — on each access point

# Reset to a clean CAP: hand both radios to CAPsMAN, discover the manager
# on the local segment, and adopt its config.
[admin@cap-lobby] > /interface/wifi/cap set enabled=yes \
    discovery-interfaces=vlan99-mgmt slaves-datapath=bridge1 \
    caps-man-addresses=10.10.99.1

# The AP's own bridge just needs the management VLAN for control + the
# guest/staff VLANs tagged on its uplink so CAPsMAN can place SSIDs on them.

⚠ Gotcha — "The CAP Won't Join" Is Almost Always Discovery or Version

Two failure modes cover 90% of stuck CAPs. First, discovery: the manager and CAP must share a Layer-2 segment (the management VLAN) for auto-discovery, or you must set caps-man-addresses= explicitly (as above) so the CAP unicasts to a manager across an L3 boundary. Second, driver/version: WifiWave2 CAPsMAN requires the manager and every CAP on compatible RouterOS 7 versions with the wifi-qcom driver — an AP still on an old package or a v6 device simply won't appear. Check /interface/wifi/capsman remote-cap print — if a CAP isn't even listed, it's discovery; if it's listed but stuck, it's version/driver.

One Configuration, Every Radio

The whole point: define the SSIDs, security, and VLAN mapping once as named configurations, then provision them to every CAP automatically. Change the config, every AP re-inherits.

RouterOS 7 — configurations + provisioning on the manager

# Security profiles (the passwords), defined once
[admin@GW] > /interface/wifi/security add name=sec-guest authentication-types=wpa2-psk,wpa3-psk passphrase="summer-in-crete"
[admin@GW] > /interface/wifi/security add name=sec-staff authentication-types=wpa2-psk,wpa3-psk passphrase="********"

# Datapath: which VLAN each SSID drops into, bridged back to the gateway
[admin@GW] > /interface/wifi/datapath add name=dp-guest bridge=bridge1 vlan-id=20
[admin@GW] > /interface/wifi/datapath add name=dp-staff bridge=bridge1 vlan-id=10

# Named configurations = SSID + security + datapath + channel plan
[admin@GW] > /interface/wifi/configuration add name=cfg-guest ssid="Hotel-Guest" security=sec-guest datapath=dp-guest
[admin@GW] > /interface/wifi/configuration add name=cfg-staff ssid="Hotel-Staff" security=sec-staff datapath=dp-staff

# Provision rule: every CAP that joins gets BOTH SSIDs, auto channel
[admin@GW] > /interface/wifi/provisioning add action=create-dynamic-enabled \
    supported-bands=2ghz-ax,5ghz-ax master-configuration=cfg-guest slave-configurations=cfg-staff

💡 Change Once, Everywhere — the Whole Reason to Do This

Season changes and the owner wants a new guest password? /interface/wifi/security set sec-guest passphrase="autumn-in-crete" — one line, and every CAP in the building updates on the next config push. New AP for the extended terrace? Plug it in, run the one cap set line from section 02, and it inherits both SSIDs, the VLAN mapping, and the channel plan with zero further config. That "one change, everywhere" is the entire return on CAPsMAN, and it's what makes a ten-AP property maintainable by one person.

Channels & Roaming

Two things separate "several APs" from "one Wi-Fi network the guest never thinks about": non-overlapping channels so the APs don't fight, and fast roaming so walking between them doesn't drop the call.

RouterOS 7 — channel plan + roaming

# Let CAPsMAN pick non-overlapping channels, or pin them per-CAP.
# 2.4GHz has only three that don't overlap: 1, 6, 11 — alternate them.
[admin@GW] > /interface/wifi/channel add name=ch-2g-auto band=2ghz-ax skip-dfs-channels=all
[admin@GW] > /interface/wifi/channel add name=ch-5g-auto band=5ghz-ax

# Enable 802.11k/v/r on the configuration so clients roam cleanly —
# neighbour reports (k), BSS transition (v), fast transition (r).
[admin@GW] > /interface/wifi/configuration set cfg-guest \
    .steering.rrm=yes .steering.wnm.bss-transition=yes

# Verify what each CAP actually chose and who's connected where:
[admin@GW] > /interface/wifi/radio print
[admin@GW] > /interface/wifi/registration-table print

⚠ Gotcha — Same SSID Is What Makes Roaming Work; Same Channel Is What Breaks It

For a guest to roam seamlessly, every CAP must broadcast the identical SSID and password — which CAPsMAN guarantees, since they share one configuration. But the flip side catches people: APs on overlapping channels (two neighbours both on 2.4GHz channel 1, or worse channels 1 and 3) interfere with each other and tank throughput for everyone in range. The fix is a channel plan — 1/6/11 on 2.4GHz, spread the wide 5GHz channels — either auto-selected or pinned per CAP by physical location. Same name, different channel: that's the recipe.

Operate & Monitor Safe to Run

Once it's running, the manager is your single pane of glass — every AP, every client, every channel, from one CLI. These are the commands you'll actually live in.

Command	What it shows
/interface/wifi/capsman remote-cap print	Every CAP, its state (Run = healthy), address, and identity.
/interface/wifi/registration-table print	Every connected client — which AP, signal, rate. The "why is room 12 slow" tool.
/interface/wifi/radio print	Each radio's chosen channel and band — spot two neighbours clashing.
/interface/wifi print	The provisioned virtual APs on each CAP (guest + staff per radio).
/log print where topics~"caps"	Join/leave events — a CAP that keeps re-joining is a PoE or uplink problem.
/interface/wifi/capsman remote-cap upgrade	Push a matching RouterOS version to every CAP at once.

💡 A CAP That Flaps Is Almost Never Wi-Fi

When a CAP repeatedly drops and re-joins in the log, resist debugging the wireless — it's nearly always physical: a marginal PoE injector, a long or damaged run to that AP, or a switch port renegotiating. The registration table and radio stats will look fine right up until the CAP vanishes. Check the switch port and PoE budget for that drop first; we've spent hours "tuning roaming" on what turned out to be a crushed cable behind a headboard.

MikroTik ↔ Cisco — Centralised Wireless

CAPsMAN is MikroTik's answer to the wireless LAN controller — same idea, a fraction of the price and licensing.

MikroTik / RouterOS 7	Cisco
CAPsMAN manager	Wireless LAN Controller (WLC) / Catalyst 9800
CAP (Controlled AP)	Lightweight AP joined to the WLC (CAPWAP)
/interface/wifi/configuration	WLAN profile + policy/RF tag
datapath vlan-id per SSID	WLAN → VLAN mapping / policy profile
provisioning rule	AP join profile + tags
steering (k/v/r)	802.11k/v/r under the RF/policy profile
Free — no per-AP licence	DNA/Smart licensing per AP

Takeaways

CAPsMAN makes many APs behave as one system — the manager holds the config, CAPs download it. Change once, every AP follows; add an AP, it inherits everything.
Use the RouterOS 7 WifiWave2 stack (/interface/wifi/...) on 7.13+ with the wifi-qcom driver — not the legacy /caps-man.
Run the control plane on the management VLAN, and tag guest/staff SSIDs onto their own VLANs via the datapath — the wireless half of segmentation.
Define SSID + security + datapath once as configurations, then a provisioning rule pushes them to every CAP automatically.
Same SSID everywhere enables roaming; a channel plan prevents self-interference. 1/6/11 on 2.4GHz, and enable 802.11k/v/r steering.
The manager is one pane of glass — remote-cap and registration-table answer "is every AP up" and "why is that room slow" from one CLI.
A flapping CAP is physical — PoE, cabling, the switch port — long before it's a wireless setting.

A property where the Wi-Fi drops as guests walk around?

NOCTIS designs and manages multi-AP wireless for hotels and villas across Crete — CAPsMAN-managed, one config, seamless roaming, guest traffic isolated, and a channel plan that survives a full house in August.

Book a Discovery Call →